sin

i like to do a little messing with games in my free time

[sin @sinfulrawr]

I decided to look into GDID after this, and reading the court document gave some hints. After poking at some stuff I can confidently say I figured out majority of the system end to end. Check it out at https://t.co/z0AtBqH0qf

p.s yes Claude helped don't come yell at me AI haters

[vx-underground @vxunderground]

> Peter Stokes
> Scattered Spider guy
> Arrested
> Microsoft helps FBI
> Read court documents
> Page 12
> Microsoft tracks Stokes from GDID
> Microsoft Global Device Identifier (GDID)
> Stokes used Windows
> Page 34
> GDID assigned to each OS install
> GDID unique to each device
> GDID only change if OS wiped
> Stokes GDID 6755467234350028
> GDID reported internet activity to Microsoft
> GDID showed Stokes using Ngrok
> GDID reported Stokes IP address
> GDID showed Stokes web activity
> GDID showed timestamps of web activity
> GDID mapped with video game activity
> GDID showed games played
> GDID undocumented
> GDID only mentioned in one MSDN document
> Azure UCDOStatus
> Azure Monitor Logging

[sin @sinfulrawr]

@NullZeroX LID is still ur GDID by the way, that wasn't claude that made that up

[sin @sinfulrawr]

I decided to look into GDID after this, and reading the court document gave some hints. After poking at some stuff I can confidently say I figured out majority of the system end to end. Check it out at https://t.co/z0AtBqH0qf

p.s yes Claude helped don't come yell at me AI haters

[vx-underground @vxunderground]

> Peter Stokes
> Scattered Spider guy
> Arrested
> Microsoft helps FBI
> Read court documents
> Page 12
> Microsoft tracks Stokes from GDID
> Microsoft Global Device Identifier (GDID)
> Stokes used Windows
> Page 34
> GDID assigned to each OS install
> GDID unique to each device
> GDID only change if OS wiped
> Stokes GDID 6755467234350028
> GDID reported internet activity to Microsoft
> GDID showed Stokes using Ngrok
> GDID reported Stokes IP address
> GDID showed Stokes web activity
> GDID showed timestamps of web activity
> GDID mapped with video game activity
> GDID showed games played
> GDID undocumented
> GDID only mentioned in one MSDN document
> Azure UCDOStatus
> Azure Monitor Logging

[sin @sinfulrawr]

@nicksummy I hope this isn't a serious question

[sin @sinfulrawr]

@n13 There is no "prompt" that generated all of this? Most of it is my own reversal.

[sin @sinfulrawr]

@witherornot1337 Yeah I'm realizing I made a few mistakes but the overall system is still correct for the most part. The git repo has been updated with a few notes through out the hours

[sin @sinfulrawr]

@insidedarknet "the suspicion is true that GDID is still sent and used regardless of a Microsoft account. CDP has an anonymous device path"

[sin @sinfulrawr]

After doing a little more RE after waking up, the suspicion is true that GDID is still sent and used regardless of a Microsoft account. CDP has an anonymous device path. I'm happy to release a GDID blocker (not just a simple domain blocker): https://t.co/miZ11NPiGj

[sin @sinfulrawr]

I decided to look into GDID after this, and reading the court document gave some hints. After poking at some stuff I can confidently say I figured out majority of the system end to end. Check it out at https://t.co/z0AtBqH0qf

p.s yes Claude helped don't come yell at me AI haters

[sin @sinfulrawr]

@insidedarknet I know, I made a tweet about that and updated the repo last night an hour after release

[sin @sinfulrawr]

@f1isabadsport Majority of it is correct, and I corrected myself after realizing that a local account does not fix it. If you read it says at the bottom. I also made another tweet stating that CDP has an anonymous path which is used if you're a local account

[sin @sinfulrawr]

@thebookisclosed This isn't to "delete your gdid". It's to disable your GDID getting constantly sent. That is how Stokes got caught. Not just because he HAD a GDID

[sin @sinfulrawr]

@hackerfantastic @harrison_v47463 You should also disable the CDP service, they could add more urls in the future. I believe they send to .activity. I have a disabler on my git now

[sin @sinfulrawr]

@NullZeroX How odd

[sin @sinfulrawr]

@NullZeroX Just go to HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties and let me know if LID is the same value that you see at IrisiActionCreatives

[sin @sinfulrawr]

@NullZeroX the only parts that have any long strings are LastContext and State which both don't contain GDID

[sin @sinfulrawr]

@NullZeroX Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\IrisService contains nothing important that I can see but it is semi-related to cdp if i remember correctly. You can see similar data in the files at %LOCALAPPDATA%\ConnectedDevicesPlatform\CDPGlobalSettings.cdp

[sin @sinfulrawr]

@NullZeroX I updated the repo, I'll look into it more whenever I wake up. Can you tell me anymore?

[sin @sinfulrawr]

@weezerOSINT larp sahur